CVE-2024-44349
Published: 08 October 2024
Summary
CVE-2024-44349 is a critical-severity SQL Injection (CWE-89) vulnerability in Cybergon (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A SQL injection vulnerability tracked as CVE-2024-44349 affects the login portal of AnteeoWMS versions prior to 4.7.34. The flaw, classified under CWE-89, resides in the handling of the username parameter and permits unauthenticated attackers to inject arbitrary SQL commands, resulting in execution of those commands and disclosure of selected data from the underlying database. The issue carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors with no required authentication or user interaction.
Unauthenticated remote attackers can exploit the vulnerability by supplying crafted input to the username field on the login page. Successful exploitation grants the ability to run arbitrary SQL statements, potentially extracting sensitive database contents or manipulating query logic without any prior credentials.
Public references include a technical analysis and proof-of-concept code demonstrating the injection. The associated EPSS score stands at 0.7620, indicating substantial exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-41016
Vulnerability details
A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username parameter and disclosure of some data in the underlying DB.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.